On June 4, 2020, three of the four authors of the most consequential COVID-19 paper of that spring signed a notice stating they could “no longer vouch for the veracity of the primary data sources.” The paper had run in The Lancet thirteen days earlier, and in those thirteen days it had done its work: it paused the World Health Organization’s flagship Solidarity trial and moved governments off hydroxychloroquine on the strength of a single number. Read the retraction notice closely and notice what it does not say. It does not say the drug was safe. It does not say the drug worked. It says something narrower and far more damaging: the authors no longer knew whether the database underneath their conclusions existed at all.
Start with what the paper claimed, because the scale was the selling point. Published on May 22, 2020 and led by Mandeep Mehra of Brigham and Women’s Hospital, it reported outcomes for 96,032 hospitalized COVID-19 patients drawn from 671 hospitals across six continents, and concluded that hydroxychloroquine was associated with higher mortality and more cardiac arrhythmia. A dataset that large, assembled that fast, in the middle of a pandemic, was itself the extraordinary claim. Within seventy-two hours the WHO suspended the hydroxychloroquine arm of Solidarity. The number did the persuading, and almost no one asked to see how the number was built.
no longer vouch for the veracity of the primary data sources
The number came from a company called Surgisphere, a small Chicago firm whose founder and chief executive, Sapan Desai, was also a co-author on the paper. The person who owned the unverifiable data was a named author on the study drawing conclusions from it. The Guardian’s investigation later reported that Surgisphere’s handful of employees included a science-fiction writer and an adult-content model. This was the enterprise that supposedly held real-time electronic records from hundreds of hospitals on six continents, harmonized and analysis-ready, while the world’s dedicated hospital data networks were still struggling to count cases.
The record it produced did not survive contact with arithmetic. According to the Guardian’s reporting, the database recorded 73 COVID-19 deaths among Australian patients by April 21, 2020. Johns Hopkins University’s count showed 67 deaths in the entire country on that date. An Asian hospital appeared in the data assigned to Australia. Reporters contacted the Melbourne and Sydney hospitals whose participation the Australian totals would have required, and each said it had never supplied data to Surgisphere and had never heard of the company. These were not rounding errors. They were the signature of a dataset that described a world that did not exist.
| Measure | Value |
|---|---|
| Surgisphere database | 73 |
| Johns Hopkins count | 67 |
When the numbers drew scrutiny, the authors commissioned an independent third-party audit. It never ran. As the retraction notice and Retraction Watch’s timeline both record, Surgisphere declined to transfer the full dataset, the client contracts, and the complete audit report to the reviewers, citing confidentiality agreements with its hospital clients. The auditors withdrew. The paper was retracted not because a statistician disproved it, but because no one could ever confirm the raw material was real. The New England Journal of Medicine retracted a companion paper built on the same database the same day. Both journals had run global-policy-moving findings that neither their editors, their peer reviewers, nor the co-authors had ever checked against a source file.
Follow the incentive and the pattern explains itself. A proprietary clinical database earns its money precisely by being proprietary. The confidentiality that made Surgisphere’s data commercially valuable was the same confidentiality that made it impossible to audit, and the two were never in tension because no one insisted they be. Peer review at these journals assessed the manuscript, not the data warehouse behind it. So a firm that claimed impossible reach got a fast track to two of the most cited journals in medicine, and the WHO moved on the output before a single independent party had examined the input. The system did not fail because it was deceived by a genius. It failed because it was built to take the number on faith.
The documents establish this much and no more, and the line matters. They establish that the authors could not confirm their own data, that the auditor could not obtain it, that Desai declined to sign the retraction his co-authors did, and that Amit Patel, another co-author and Desai’s brother-in-law, had his faculty appointment terminated as the scandal broke. They do not establish that hydroxychloroquine works, and this publication will not pretend otherwise. They do not require a theory of coordinated bad faith. They document something worse than a conspiracy, because it is repeatable: an entire evidentiary apparatus changed the treatment of a global disease on the word of a database it never checked.
Six years on, that failure has not been closed. The investigative reporter Maryanne Demasi has been tracing what she calls the real-world data dilemma: the accelerating reliance of regulators and drug developers on large commercial “real-world” datasets to support approvals, label expansions, and safety decisions, in place of the trials such data is meant to supplement. By her reporting, and by the question a 2025 paper in the journal Leukemia put in its own title, “Are real world data real world data?”, the commercial databases now feeding these decisions are as closed to independent inspection as Surgisphere’s was. The lesson the establishment took from 2020 was that Surgisphere was a bad apple. The lesson the records support is that the barrel has no inspector.
So name what remains open. The full Surgisphere dataset and its client contracts were never produced to any independent party, and Desai has never publicly accounted for how records that could not be reconciled with a single named hospital came to sit in two of the world’s leading journals. The agencies that moved on that output have not, on the record, imposed a standing independent-audit requirement on the commercial datasets they still accept as evidence, and by Demasi’s account the reliance on those closed datasets has only deepened. The obligation is not on the skeptics who caught the arithmetic; it sits with the agencies and the journals that moved first and verified later, and it is still sitting there. The next fabricated database will not announce itself. The only question the record leaves is who will be required to look before the policy changes, and right now the answer is no one.
Sources
- The Lancet – Retraction: Hydroxychloroquine or chloroquine for treatment of COVID-19 (Mehra et al.), June 4, 2020
- The Guardian – Surgisphere: governments and WHO changed Covid-19 policy based on suspect data from a tiny US company (June 3, 2020)
- New England Journal of Medicine – Retraction: Cardiovascular Disease, Drug Therapy, and Mortality in Covid-19 (Mehra et al.), June 4, 2020
- Retraction Watch – Lancet, NEJM retract controversial COVID-19 studies based on Surgisphere data (2020)
- Health Policy Watch – WHO pauses hydroxychloroquine arm of COVID-19 clinical trial after Lancet study (May 2020)
- STAT News – Researcher in retracted Lancet study has faculty appointment terminated as details emerge (June 7, 2020)
- Maryanne Demasi – The Real-World Data Dilemma, Part 1 (2026)